Behavioral Distance for Intrusion Detection

  • Debin Gao
  • Michael K. Reiter
  • Dawn Song
Conference paper

DOI: 10.1007/11663812_4

Volume 3858 of the book series Lecture Notes in Computer Science (LNCS)
Cite this paper as:
Gao D., Reiter M.K., Song D. (2006) Behavioral Distance for Intrusion Detection. In: Valdes A., Zamboni D. (eds) Recent Advances in Intrusion Detection. RAID 2005. Lecture Notes in Computer Science, vol 3858. Springer, Berlin, Heidelberg

Abstract

We introduce a notion, behavioral distance, for evaluating the extent to which processes—potentially running different programs and executing on different platforms—behave similarly in response to a common input. We explore behavioral distance as a means to detect an attack on one process that causes its behavior to deviate from that of another. We propose a measure of behavioral distance and a realization of this measure using the system calls emitted by processes. Through an empirical evaluation of this measure using three web servers on two different platforms (Linux and Windows), we demonstrate that this approach holds promise for better intrusion detection with moderate overhead.

Keywords

Intrusion detection system call behavioral distance 

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

Copyright information

© Springer-Verlag Berlin Heidelberg 2006

Authors and Affiliations

  • Debin Gao
    • 1
  • Michael K. Reiter
    • 2
  • Dawn Song
    • 2
  1. 1.Electrical & Computer Engineering DepartmentCarnegie Mellon UniversityPittsburghUSA
  2. 2.Electrical & Computer Engineering Department, Computer Science Department, and CyLabCarnegie Mellon UniversityPittsburghUSA